Explicit InsertUpdateDelete Permission Required

12-22 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

12.5.3 Creating and Managing Role Categories

Role categories are a way of categorizing roles for the purpose of navigation and authorization. Role categories are internally stored in Oracle Identity Manager as an attribute of the role and is reconciled with the multivalued business category attribute in the LDAP identity store. If the value in LDAP is empty, then the role is assigned to the system-managed Uncategorized role category. If the value in LDAP has multiple values or a single, unrecognized value, then the role reconciliation process does not reconcile the role and generates reconciliation errors in Oracle Identity Manager. The default role categories in Oracle Identity Manager are: ■ OIM Roles: All the predefined roles in Oracle Identity Manager are assigned to this category. These are roles that exist in Oracle Identity Manager by default and are primarily used for managing permissions. There will not be any corresponding entity in LDAP store for these predefined roles ■ Default: A newly created role must have a role category. Therefore, if a role category is not specified at the time of creating the role, then the role is assigned to this category by default. This section describes the following topics: ■ Creating a Role Category ■ Searching Role Categories ■ Modifying a Role Category ■ Deleting a Role Category

12.5.3.1 Creating a Role Category

To create a role category: 1. Login to Oracle Identity Administration.

2. In the Welcome page, under Roles, click Create Role Category.

Alternatively, in the Browse tab of the left pane, expand Roles, and from the Actions menu, select Create Category. Otherwise, click Create Category icon on the toolbar. The Create Role Category page is displayed. 3. In the Category Name box, enter the name of the role category. 4. In the Description box, enter a description for the role category. This step is optional.

5. Click Save. A page is displayed with a message on the top of the page stating that

the role category is created. The page consists of the Attributes and Roles tabs. The Attributes tab displays the attributes of the role category. You can edit the fields in this tab to edit the role category. The Roles tab displays the list of roles belonging to the role category.

12.5.3.2 Searching Role Categories

To search for role categories:

1. In the Welcome page, under Roles, click Advanced Search - Role Categories. The

Advanced Search: Categories page is displayed. Managing Roles 12-23 2. In the Category Name field, enter a search criterion. You can enter the asterix wildcard character in the search criterion. 3. From the list adjacent to the Category Name field, select a search comparator. The default search comparator is Begins With. However, Equals search comparator can be used.

4. If you want to add a field to the search condition, then click Add Fields. From the

list, select Description. The Description field is added to the Advanced Search: Categories page. You can specify a search criterion in the Description field to search by description. To remove the Description field from the search condition, click the cross icon adjacent to the Description field.

5. Click Search. The categories that match search criteria you specified are displayed

in the search results table.

12.5.3.3 Modifying a Role Category

To modify a role category:

1. In the Browse tab of the left pane, expand Roles.

2. Select the role category that you want to modify.

3. From the Actions menu, select Open. Alternatively, click the Open Role or

Category Detail icon on the toolbar. A page with details about the role category is displayed.

4. The Attributes tab is open by default. Edit the fields in this tab to modify basic

category information such as name and description. When finished, click Apply. 5. Click the Roles tab. In this tab, you can view all roles that are assigned to this category. To view role details assigned to a role category: a. In the Roles tab of the role category details page, select the role that you want to view details.

b. From the Actions menu, select Open Open Role Detail. Alternatively, you

can click Open Open Role Detail on the toolbar. The Role Detail page for the selected role is displayed.

12.5.3.4 Deleting a Role Category

To delete a role category: 1. In the browse tree for roles in the left pane, select a role category that you want to delete.

2. From the Actions menu, select Delete. Alternatively, click the Delete icon on the

toolbar. If the role category detail page is open, then click Delete Role Category on the toolbar. A message box is displayed asking for confirmation.

3. Click Yes. The role category is deleted.

12.6 Managing Authorization for Roles

When a user logs in to Oracle Identity Manager, the links, buttons, and menus associated with the actions that the user can perform are displayed. For example, on the Welcome page of Oracle Identity Manager Administration, the Advanced Search - 12-24 Oracle Fusion Middleware Users Guide for Oracle Identity Manager Roles link is displayed if the user is authorized to perform advanced search for roles. The actions that the user is authorized to perform is determined by the authorization policies. These authorization policies are defined for Oracle Identity Manager and stored in Oracle Entitlements Server OES. The policies are enforced at runtime to control the authorization to perform various tasks in the UI. Authorization policies control the access to various operations with the help of permissions. Table 12–8 lists the permissions for role management operations: See Also: Chapter 15, Managing Authorization Policies for detailed information about authorization policies Table 12–8 Role Management Permissions Permission Description Create Role Determines if the user can create a role Note: This permission is not associated with a specific role. Modify Role Detail Determines if the user can update a specific role Delete Role Determines if the user can delete a specific role View Role Detail Determines if the user can view a specific role and the complete hierarchy of the specific role Search for Role Determines if the user can search for roles Note: This permission is not associated with a specific role. Modify Role Membership Determines if the user can grant or revoke a specific role to a user. Modify Role Hierarchy Determines if the user can add or remove a child role to or from a specific role View Role Membership Determines the user to whom the specific role is granted Create Role Category Determines is the user can create a role category Note: This permission is not associated with a specific role category or role. Modify Role Category Determines if the user can update a role category Note: This permission is not associated with a specific role category or role. Delete Role Category Determines if the user can delete a role category Note: This permission is not associated with a specific role category or role. View Role Category Detail Determines if the user can view the details of a role category Note: This permission is not associated with a specific role category or role. Search for Role Categories Determines if the user can search for role categories Note: This permission is not associated with a specific role category or role. Note: When a role is granted to a user, the Modify Role Membership permission must be granted to the specific role that you are trying to grant.